Assuming I'm injecting a shellcode into a Windows GUI application, I know I could:

  • Gets kernel32.dll base address through the PEB (Process Environment Block);
  • Finds address of LoadLibrary;
  • Call LoadLibrary("user32.dll");
  • Finally call GetProcAddress.

This is the classic way and that's what I would do, however I'd like to know if there's a better/improved/faster/clever/different/smaller or simpler way to do this.

Any ideas?

1 Answer 1


If user32.dll is already loaded in the process's address space (and I assume it is given that you said it's a Windows GUI application), you can walk the PEB_LDR_DATA structure in order to find the base address of user32.dll:


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.